CVE-2026-72529 is a critical vulnerability in TrueConf Server, a video conferencing and collaboration platform used by organizations to support internal meetings, customer engagement, and remote work. The flaw allows an attacker with network access to a vulnerable server to run arbitrary scripts without signing in first.
Because TrueConf Server often handles sensitive conversations, screen sharing, files, and identity information, organizations that rely on it should treat this issue as an urgent operational risk. The vulnerability has also been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities Catalog, which indicates that exploitation is not merely theoretical.
This post explains what the vulnerability means for your business, who is affected, how to determine exposure, and what your IT and security teams should do now. A technical appendix provides detection, verification, and remediation guidance for security engineers and IT administrators.
Kaspersky ICS CERT researcher Vyacheslav Kopeytsev reported the vulnerability. The CVE record was published on August 19, 2026, and CISA added it to its Known Exploited Vulnerabilities Catalog on August 20, 2026, with a federal remediation due date of August 23, 2026.
The affected product is TrueConf Server on Windows and Linux. Versions before the fixed releases in the 5.3, 5.4, and 5.5 branches are vulnerable, including all earlier releases.
The issue is classified as CWE-306, Missing Authentication for a Critical Function. In practical terms, the server exposes a function that should require a verified, authorized user but can be reached by an unauthenticated remote attacker. Kaspersky assigned the vulnerability a CVSS 4.0 base score of 9.3, placing it in the Critical severity range.
If your organization operates an exposed TrueConf Server, an attacker may be able to run commands or scripts on the server without a username, password, or other authentication step. That can turn a video conferencing system into an entry point into your broader corporate network.
The immediate operational risk is disruption. An attacker could interfere with conferencing services, alter server configurations, delete or corrupt data, or use the server as a staging point for further attacks. For organizations that depend on virtual meetings for sales, customer support, clinical coordination, legal consultations, or internal operations, even short downtime can interrupt revenue and essential workflows.
The data risk is equally significant. Conferencing platforms may contain meeting metadata, participant identities, chat content, shared files, and credentials or tokens used to connect with other systems. Compromise of the server could expose this information or enable attackers to move toward email, file storage, identity systems, and other internal applications.
There are also compliance and reputational consequences. Organizations subject to data protection, financial, healthcare, or government contracting requirements may need to assess whether sensitive information was accessible, notify affected parties where required, and demonstrate timely remediation. A publicized compromise of a communication platform can damage customer trust, particularly if attackers accessed meetings or internal communications.
Because CISA lists CVE-2026-72529 as known exploited, delay is a business decision with measurable risk. Organizations in the United States and Canada should prioritize inventory, patching, exposure review, and compromise assessment rather than waiting for routine maintenance cycles.
Regional financial services firm: A regional bank uses TrueConf Server for branch meetings, loan reviews, and vendor discussions. If an attacker compromises the server, they could access meeting details involving customer accounts or internal controls and use the foothold to reach systems connected to the conferencing environment.
Mid-sized healthcare provider: A healthcare organization uses TrueConf for telehealth coordination and clinical team meetings. A successful attack could disrupt appointment-related communication, expose patient or staff information, and trigger regulatory review if protected health information was potentially accessible.
Professional services company: A consulting firm relies on TrueConf Server for client calls and internal project reviews. An attacker could monitor or disrupt client-facing meetings, steal proposal or contract material, and use compromised infrastructure to launch phishing campaigns that appear to originate from the firm.
Public-sector agency: A municipal government operates TrueConf Server for interdepartmental coordination and public briefings. Exploitation could interrupt emergency coordination, expose internal planning discussions, and require costly incident response, forensic investigation, and public communication.
If your organization uses TrueConf Server or is unsure whether conferencing infrastructure is exposed, IntegSec can help you move from uncertainty to a clear action plan. Our penetration testing team can validate exposure, assess exploitation paths, test the resilience of your surrounding controls, and help prioritize remediation based on business risk. Visit https://integsec.com to schedule a conversation with our security team.
CVE-2026-72529 is a missing-authentication vulnerability in TrueConf Server, tracked as CWE-306, Missing Authentication for Critical Function. The affected component exposes an undocumented function through TCP port 4307. A remote, unauthenticated attacker with network reachability to that port can invoke the function and cause the server to execute an arbitrary script.
The attack requires no privileges, no user interaction, and no special conditions beyond network access. The CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, with a CVSS-B base score of 9.3 Critical. The Kaspersky ICS CERT advisory is the primary vendor-linked reference, and the CVE record credits Vyacheslav Kopeytsev of Kaspersky ICS CERT as the finder.
The principal risk is remote code execution on the TrueConf Server host. Once code execution is achieved, an attacker may attempt privilege escalation, credential theft, lateral movement, persistence, or access to integrated services, depending on the server’s configuration and network position.
Version enumeration commands:
Get-Package, the Windows Programs and Features inventory, or the TrueConf Server administration interface.dpkg -l | grep -i trueconf or rpm -qa | grep -i trueconf.Scanner signatures: Configure authenticated and unauthenticated vulnerability scans to test for CVE-2026-72529 and verify that TCP port 4307 is identified on each TrueConf Server host. Tenable and other vulnerability databases list the issue, so ensure scanner plugins and feed data are current.
Log indicators: Review TrueConf Server application logs, operating-system process creation logs, and endpoint detection telemetry for unexpected script execution, unusual child processes, new scheduled tasks, unfamiliar service installations, or outbound connections immediately following requests to port 4307.
Behavioral anomalies: Look for unexpected administrative changes, new or modified user accounts, altered conferencing configurations, abnormal file activity in application directories, and authentication anomalies around the disclosure and exploitation window.
Network exploitation indicators: Monitor for external or unexpected internal connections to TCP port 4307, particularly connections that do not originate from approved load balancers, reverse proxies, administrative systems, or known client ranges. Preserve relevant firewall, proxy, and server logs before remediation where feasible.
For environments that cannot patch immediately, use compensating controls: deny inbound access to port 4307 from untrusted networks, enforce allowlisting for administrative sources, increase logging and alerting, restrict the server’s ability to initiate outbound connections, and maintain offline or tested backups. These measures reduce risk but do not replace the vendor patch.